August 2021 - Cloud Kernel - lists.openanolis.cn

[4.19 PATCH] fuse: add FUSE_WRITE_KILL_PRIV

by Jeffle Xu

From: Miklos Szeredi <mszeredi(a)redhat.com> commit 4a2abf99f9c2877039006b8dfb3ec4e0d1278fe8 upstream In the FOPEN_DIRECT_IO case the write path doesn't call file_remove_privs() and that means setuid bit is not cleared if unpriviliged user writes to a file with setuid bit set. pjdfstest chmod test 12.t tests this and fails. Fix this by adding a flag to the FUSE_WRITE message that requests clearing privileges on the given file. This needs This better than just calling fuse_remove_privs(), because the attributes may not be up to date, so in that case a write may miss clearing the privileges. Test case: $ passthrough_ll /mnt/pasthrough-mnt -o default_permissions,allow_other,cache=never $ mkdir /mnt/pasthrough-mnt/testdir $ cd /mnt/pasthrough-mnt/testdir $ prove -rv pjdfstests/tests/chmod/12.t Reported-by: Vivek Goyal <vgoyal(a)redhat.com> Signed-off-by: Miklos Szeredi <mszeredi(a)redhat.com> Tested-by: Vivek Goyal <vgoyal(a)redhat.com> Signed-off-by: Jeffle Xu <jefflexu(a)linux.alibaba.com> --- Corresponding virtiofsd commits can refer to [1] virtiofsd: Parse flag FUSE_WRITE_KILL_PRIV https://gitlab.com/virtio-fs/qemu/-/commit/f779bc5265e7e7abb13a03d4bfbc7415… [2] virtiofsd: Drop CAP_FSETID if client asked for it https://gitlab.com/virtio-fs/qemu/-/commit/ee88465224b3aed2596049caa28f86cb… --- fs/fuse/file.c | 11 +++++++++-- include/uapi/linux/fuse.h | 5 +++++ 2 files changed, 14 insertions(+), 2 deletions(-) diff --git a/fs/fuse/file.c b/fs/fuse/file.c index 80f991ac4a0a..e6d2e5e2b072 100644 --- a/fs/fuse/file.c +++ b/fs/fuse/file.c @@ -1404,10 +1404,17 @@ ssize_t fuse_direct_io(struct fuse_io_priv *io, struct iov_iter *iter, if (err && !nbytes) break; - if (write) + if (write) { + if (!capable(CAP_FSETID)) { + struct fuse_write_in *inarg; + + inarg = &req->misc.write.in; + inarg->write_flags |= FUSE_WRITE_KILL_PRIV; + } nres = fuse_send_write(req, io, pos, nbytes, owner); - else + } else { nres = fuse_send_read(req, io, pos, nbytes, owner); + } if (!io->async) fuse_release_user_pages(req, io->should_dirty); diff --git a/include/uapi/linux/fuse.h b/include/uapi/linux/fuse.h index 1c6956b32597..5a011734a97b 100644 --- a/include/uapi/linux/fuse.h +++ b/include/uapi/linux/fuse.h @@ -120,6 +120,9 @@ * 7.28 * - add FOPEN_CACHE_DIR * - add FUSE_CACHE_SYMLINKS + * + * 7.31 + * - add FUSE_WRITE_KILL_PRIV flag */ #ifndef _LINUX_FUSE_H @@ -315,9 +318,11 @@ struct fuse_file_lock { * * FUSE_WRITE_CACHE: delayed write from page cache, file handle is guessed * FUSE_WRITE_LOCKOWNER: lock_owner field is valid + * FUSE_WRITE_KILL_PRIV: kill suid and sgid bits */ #define FUSE_WRITE_CACHE (1 << 0) #define FUSE_WRITE_LOCKOWNER (1 << 1) +#define FUSE_WRITE_KILL_PRIV (1 << 2) /** * Read flags -- 2.27.0

2 years, 7 months

2
2
0 0

anolis-linux

by byhoo

2 years, 8 months

1
0
0 0

[PATCH] ck: virtiofs: remove unused vertab_len and vertab_kaddr fields

by Jeffle Xu

These two fields were originally introduced for metadata coherency, and shall be used by [1]. However, this feature doesn't get merged to upstream, and we didn't backport [1] yet. Thus remove these two stale fields. [1] "fuse: add shared version support" https://www.mail-archive.com/linux-kernel@vger.kernel.org/msg1873773.html Signed-off-by: Jeffle Xu <jefflexu(a)linux.alibaba.com> --- fs/fuse/fuse_i.h | 6 ------ 1 file changed, 6 deletions(-) diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h index 83632816b581..c0799cc2249f 100644 --- a/fs/fuse/fuse_i.h +++ b/fs/fuse/fuse_i.h @@ -83,12 +83,6 @@ struct fuse_mount_data { /* fuse_dev pointer to fill in, should contain NULL on entry */ void **fudptr; - - /* version table length in bytes */ - size_t vertab_len; - - /* version table kernel address */ - void *vertab_kaddr; }; /* One forget request */ -- 2.27.0

2 years, 8 months

3
4
0 0

[ANCK-4.19 PATCH 0/9] fuse: support CACHE_DIR/CACHE_SYMLINK

by Jeffle Xu

patch 1-8: support CACHE_DIR patch 9: support CACHE_SYMLINK Dan Schatzberg (1): fuse: enable caching of symlinks Miklos Szeredi (7): fuse: add FOPEN_CACHE_DIR fuse: extract fuse_emit() helper fuse: allow caching readdir fuse: allow using readdir cache fuse: add readdir cache version fuse: use mtime for readdir cache verification fuse: use iversion for readdir cache verification Tejun Heo (1): fuse: fix beyond-end-of-page access in fuse_parse_cache() fs/fuse/dir.c | 129 +++++++++++---- fs/fuse/file.c | 2 + fs/fuse/fuse_i.h | 46 ++++++ fs/fuse/inode.c | 9 +- fs/fuse/readdir.c | 330 ++++++++++++++++++++++++++++++++++++-- include/uapi/linux/fuse.h | 8 + 6 files changed, 482 insertions(+), 42 deletions(-) -- 2.27.0

2 years, 8 months

2
18
0 0

[PATCH 01/17] Crypto: CCP: Add a new interface for X86 sending command to PSP

by fenghao＠openanolis.org

From: niuyongwen <niuyongwen(a)hygon.cn> HYGON's fTPM and TDM need to send commands to PSP to complete the firmware function. In order to be compatible with the original kernel code, The command of psp_do_cmd is added to send the command from x86 to PSP. The interface is currently used for fTPM and TDM of HYGON. Change-Id: I47b01f10e67ea77cf31c7b021532728f1c3f1323 Signed-off-by: niuyongwen <niuyongwen(a)hygon.cn> --- drivers/crypto/ccp/psp-dev.c | 6 ++++++ include/linux/psp-sev.h | 4 ++++ 2 files changed, 10 insertions(+) diff --git a/drivers/crypto/ccp/psp-dev.c b/drivers/crypto/ccp/psp-dev.c index 1603dc8d2d75..cf65991723c4 100644 --- a/drivers/crypto/ccp/psp-dev.c +++ b/drivers/crypto/ccp/psp-dev.c @@ -216,6 +216,12 @@ static int sev_do_cmd(int cmd, void *data, int *psp_ret) return rc; } +int psp_do_cmd(int cmd, void *data, int *psp_ret) +{ + return sev_do_cmd(cmd, data, psp_ret); +} +EXPORT_SYMBOL_GPL(psp_do_cmd); + static int __sev_platform_init_locked(int *error) { struct psp_device *psp = psp_master; diff --git a/include/linux/psp-sev.h b/include/linux/psp-sev.h index 827c601841c4..6a5854ac5e93 100644 --- a/include/linux/psp-sev.h +++ b/include/linux/psp-sev.h @@ -487,6 +487,8 @@ struct sev_data_dbg { #ifdef CONFIG_CRYPTO_DEV_SP_PSP +int psp_do_cmd(int cmd, void *data, int *psp_ret); + /** * sev_platform_init - perform SEV INIT command * @@ -603,6 +605,8 @@ void *psp_copy_user_blob(u64 __user uaddr, u32 len); #else /* !CONFIG_CRYPTO_DEV_SP_PSP */ +static inline int psp_do_cmd(int cmd, void *data, int *psp_ret) { return -ENODEV; } + static inline int sev_platform_status(struct sev_user_data_status *status, int *error) { return -ENODEV; } -- 2.17.1

2 years, 8 months

1
16
0 0

2024

2023

2022

2021

Cloud Kernel August 2021